I set up a Django project for smartphone serving XML-RPC methods over HTTPS and using basic auth. All XML-RPC methods require username and password.
I would like to implement a XML-RPC method to provide registration to the system.
Obviously, this method should not require username and password. The following is the Apache conf section responsible for basic auth:

<Location /RPC2>
    AuthType Basic
    AuthName "Login Required"
    Require valid-user
    AuthBasicProvider wsgi
    WSGIAuthUserScript  /path/to/auth.wsgi

This is my auth.wsgi:

import os
import sys
sys.stdout = sys.stderr

os.environ['DJANGO_SETTINGS_MODULE'] = 'project.settings'

from django.contrib.auth.models import User
from django import db

def check_password(environ, user, password):
    Authenticates apache/mod_wsgi against Django's auth database.


    kwargs = {'username': user, 'is_active': True} 

        # checks that the username is valid
           user = User.objects.get(**kwargs)
        except User.DoesNotExist:
           return None

        # verifies that the password is valid for the user
        if user.check_password(password):
            return True
            return False

There are two dirty ways to achieve my aim with current situation:

  1. Have a dummy username/password to be used when trying to register to the system
  2. Have a separate Django/XML-RPC application on another URL (ie: /register) that is not protected by basic auth

Both of them are very ugly, as I would also like to define a standard protocol to be used for services like mine (it's an open Dynamic Ridesharing Architecture)

Is there a way to unprotect a single XML-RPC call (ie. a defined POST request) even if all XML-RPC calls over /RPC2 are protected?


This may sound like crazy talk, but can your check_password() function see what it needs to do its job, and just return "ok" if the target is the one you wish to unprotect?

I don't know Django at all, so it's possible your check_password() is not even called if there is no username/password if Django catches that before it would call your code.

  • I also believe that check_password() is not called if there is no username and password. I suspect this also because the WSGIAuthUserScript should be called after the authentication "input" has been given. – bodom_lx May 25 '10 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy